Germany

In Germany, the AML compliance program and officer obligations under the German Money Laundering Act (GwG) and the Banking Act (KWG) entail an obligation that is continuous in nature and is distinguished by a continuous (real-time / daily) time value. The above obligations are mandated in Section 6 and Section 7 of the GwG, as well as the MaRisk circular issued by BaFin, in which all financial and non-financial obliged entities are obligated to create a continuous risk management system. This involves having a continuous risk management system, which entails the appointment of a Money Laundering Reporting Officer (MLRO / Geldwäschebeauftragter) with absolute executive authority to conduct continuous corporate surveillance. In terms of its operation, the continuous tracking is continuous within the organization's environment and consists of performing continuous automated screening of the global asset freezing database, continuous real-time transaction monitoring, and continuous analysis of risks within the organization (Risikoanalyse) to prevent the financial exploitation of the market. The above structural demands are overseen within a two-tiered arrangement by BaFin and Deutsche Bundesbank, where not observing these active daily controls attracts serious administrative penalties.

According to the German Money Laundering Act (GwG), the Anti-Money Laundering Record Retention requirement is defined strictly as a retention requirement and is regulated by a fixed time period, namely 5 years. This statutory obligation, which has been established according to Section 8 of the GwG and clarified by BaFin, implies that obliged financial and non-financial institutions shall store customer due diligence (KYC), risk assessment, and transaction history in a reliable, unalterable form. In contrast to a general calendar plan, the five-year period will commence at the moment of closing of an account in the case of customer identification records and at the end of the execution year in the case of individual transaction records. The requirement guarantees that a full financial audit trail is entirely organized and available immediately for the BaFin, the Deutsche Bundesbank, the FIU, and the judiciary in the process of a money laundering investigation, irrespective of any GDPR requests for erasing data.

As per the German Money Laundering Act (GwG), the concept of Customer Due Diligence (KYC/CDD) is understood to be an obligation in real-time/daily terms [GwG, MaRisk]. This main compliance requirement, which has been developed pursuant to sections 10 to 15 of the GwG and interpretative guidelines by BaFin, requires that obliged financial and non-financial institutions continuously monitor their customer base rather than performing static identity verification [GwG]. The system functions in real time and ensures that all customer information, transaction patterns, and socio-economic information undergo dynamic monitoring, where automated checks are performed daily against the worldwide sanctions list and PEP database [GwG, MaRisk]. It is also characterized by various risk-based tempos of operation which range from triggering immediate update of data in case of suspicious transactions to conducting periodic reviews in accordance with the risk levels of clients [GwG, MaRisk]. All information must also remain fully auditable by BaFin and the Deutsche Bundesbank.

In accordance with the German Money Laundering Act (GwG), the Suspicious Transaction Reporting regime refers to an event-based requirement driven by the strict time value of immediate / without delay. The legal requirement, which has been stipulated by Section 43 of the GwG and put in place through the German Financial Intelligence Unit (FIU), requires that as soon as a compliance officer or a Money Laundering Reporting Officer (MLRO) determines the existence of a suspicion that funds or a transaction is associated with money laundering, tax evasion, or terrorist financing, a formal electronic report shall be made immediately through the goAML portal. Contrary to the calendar-based procedure, this requirement shall arise only in response to the occurrence of an irresolvable transaction warning or risky conduct on the part of the client. Practically, the report shall be made before undertaking the transaction to afford the FIU or prosecutors regulatory powers to block or immediately after the execution of the transaction in case there is no absolute block.